Secure Boot

Please note! This wiki is no longer maintained. Our documentation has moved to https://securityonion.net/docs/. Please update your bookmarks. You can find the latest version of this page at: https://securityonion.net/docs/Secure-Boot.

Modern kernels prevent the loading of unsigned third party modules (like PF_RING) if UEFI Secure Boot is enabled. An example of this can be found here:
https://groups.google.com/d/msg/security-onion/r64yl58KGJ4/uRedkKTBCAAJ

If you have problems with Snort/Suricata/Bro/PF_RING and have UEFI Secure Boot enabled, you can disable Secure Boot:
https://wiki.ubuntu.com/UEFI/SecureBoot/DKMS
http://askubuntu.com/questions/762254/why-do-i-get-required-key-not-available-when-install-3rd-party-kernel-modules

In the future, we will transition from PF_RING to AF_PACKET and this will no longer be an issue.